rea-agents 2.5.0 → 3.1.0

package/dist/domain/processReactiveMatching.js

@@ -125,13 +125,20 @@ const matchTerminalText = (trigger, context) => {
         overflow: false,
     };
 };
-const mergeMatches = (matches) => ({
-    matched: matches.every(({ matched }) => matched),
-    eventIds: [...new Set(matches.flatMap(({ eventIds }) => eventIds))],
-    consumeIds: [...new Set(matches.flatMap(({ consumeIds }) => consumeIds))],
-    lastOrder: Math.max(-1, ...matches.map(({ lastOrder }) => lastOrder)),
-    overflow: matches.some(({ overflow }) => overflow),
-});
+const mergeMatches = (matches) => {
+    const base = {
+        eventIds: [...new Set(matches.flatMap(({ eventIds }) => eventIds))],
+        consumeIds: [...new Set(matches.flatMap(({ consumeIds }) => consumeIds))],
+        lastOrder: Math.max(-1, ...matches.map(({ lastOrder }) => lastOrder)),
+    };
+    return matches.every(({ matched }) => matched)
+        ? { ...base, matched: true, overflow: false }
+        : {
+            ...base,
+            matched: false,
+            overflow: matches.some(({ overflow }) => overflow),
+        };
+};
 const matchEarliestPrefix = (trigger, context) => {
     for (const observation of context.snapshot.observations) {
         if (observation.capture_order <= context.afterOrder)

package/dist/domain/processReactiveTransition.js

@@ -11,6 +11,8 @@ const incrementCounter = (counters, id) => {
 };
 /** Commit one uniquely selected transition after its declarative effects succeed. */
 const applyProcessReactiveTransition = (input) => {
+    if (input.effectResults.length !== input.transition.actions.length)
+        throw new TypeError("Reactive transition effects do not match the admitted actions");
     const outcome = input.transition.target.kind === "finish"
         ? input.transition.target.outcome
         : null;
@@ -31,13 +33,17 @@ const applyProcessReactiveTransition = (input) => {
     for (const eventId of input.consumeEventIds)
         consumed.add(eventId);
     const checkpoints = [...input.snapshot.checkpoints];
-    for (const [index, action] of input.transition.actions.entries())
+    for (const [index, action] of input.transition.actions.entries()) {
+        const effect = input.effectResults[index];
+        if (effect === undefined)
+            throw new TypeError("Reactive transition effect is missing");
         if (action.type === "checkpoint")
             checkpoints.push({
                 name: action.name,
-                event_id: input.effectResults[index].observation.event_id,
-                capture_order: input.effectResults[index].observation.capture_order,
+                event_id: effect.observation.event_id,
+                capture_order: effect.observation.capture_order,
             });
+    }
     const completedCaptureOrder = Math.max(input.observation.capture_order, ...input.effectResults.map(({ observation }) => observation.capture_order));
     let next = {
         ...input.snapshot,

package/dist/domain/processScenario.js

@@ -283,7 +283,9 @@ export const processScenarioSchema = z
     .strict()
     .superRefine((scenario, context) => {
     for (let index = 1; index < scenario.events.length; index += 1) {
-        if (scenario.events[index].at_ms < scenario.events[index - 1].at_ms) {
+        const event = scenario.events[index];
+        const previous = scenario.events[index - 1];
+        if (eventsOutOfOrder(event, previous)) {
             context.addIssue({
                 code: "custom",
                 message: "events must be ordered by at_ms",
@@ -361,15 +363,16 @@ export const processScenarioSchema = z
             path: ["replay"],
         });
 });
+const eventsOutOfOrder = (event, previous) => event !== undefined && previous !== undefined && event.at_ms < previous.at_ms;
 /** Parse untrusted process scenario input and apply safe default budgets. */
 export const parseProcessScenario = (input) => processScenarioSchema.parse(input);
 const isWithin = (candidate, root) => resolve(candidate) === resolve(root) ||
     resolve(candidate).startsWith(`${resolve(root)}${resolve(root).endsWith("/") ? "" : "/"}`);
 /** Evaluate scenario authority before any process or filesystem side effect occurs. */
 export const authorizeProcessScenario = (scenario, policy) => {
-    if (!policy.enabled)
+    if (policy.status === "disabled")
         return { allowed: false, reason: "process capture is disabled" };
-    if (scenario.network_access === "host" && !policy.allowExternalNetwork)
+    if (scenario.network_access === "host" && policy.networkAccess === "none")
         return {
             allowed: false,
             reason: "host network access is not approved by operator policy",

package/dist/domain/processTraceComparison.js

@@ -9,8 +9,9 @@ export const compareProcessTraces = (left, right, specificationInput) => {
         ...validateProcessCapture(left),
         ...validateProcessCapture(right),
     ];
-    if (captureIssues.length > 0)
-        throw new TypeError(`Invalid Process Capture v4: ${captureIssues[0].path}`);
+    const firstCaptureIssue = captureIssues.at(0);
+    if (firstCaptureIssue !== undefined)
+        throw new TypeError(`Invalid Process Capture v4: ${firstCaptureIssue.path}`);
     const specification = processTraceSpecificationSchema.parse(specificationInput);
     const leftEvaluation = evaluateProcessTraceSide(left, specification);
     const rightEvaluation = evaluateProcessTraceSide(right, specification);

package/dist/domain/protocolCapture.js

@@ -0,0 +1,245 @@
+import { z } from "zod";
+import { jsonValueSchema } from "./jsonValue.js";
+/** Supported protocol families for structured protocol capture. */
+export const protocolFamilySchema = z.enum([
+    "grpc",
+    "protobuf",
+    "json-rpc",
+    "messagepack",
+]);
+/** A decoded field from a protocol message. */
+export const decodedFieldSchema = z.strictObject({
+    /** Field name or path within the message structure. */
+    path: z.string().min(1),
+    /** Wire type or encoding hint. */
+    wire_type: z.string().nullable(),
+    /** Decoded field value. */
+    value: jsonValueSchema.nullable(),
+    /** Whether this field value was inferred rather than decoded. */
+    inferred: z.boolean().default(false),
+});
+/** Schema inference hypothesis for a repeated message pattern. */
+export const schemaHypothesisSchema = z.strictObject({
+    /** Hypothesized field name. */
+    field_name: z.string().min(1),
+    /** Inferred type. */
+    inferred_type: z.string().min(1),
+    /** Confidence: 0-1 */
+    confidence: z.number().min(0).max(1),
+    /** Supporting evidence count. */
+    evidence_count: z.number().int().nonnegative(),
+});
+/** Result of decoding a single protocol message. */
+export const protocolMessageSchema = z.strictObject({
+    /** Monotonic sequence number. */
+    sequence: z.number().int().nonnegative(),
+    /** Timestamp in milliseconds. */
+    at_ms: z.number().int().nonnegative(),
+    /** Protocol family. */
+    family: protocolFamilySchema,
+    /** Direction of the message. */
+    direction: z.enum(["request", "response"]),
+    /** Transport endpoint or path (e.g. gRPC method path). */
+    endpoint: z.string().nullable(),
+    /** Content type of the raw payload. */
+    content_type: z.string().nullable(),
+    /** Raw payload bytes as base64. */
+    raw_payload: z.string().nullable(),
+    /** Decoded fields from the payload. */
+    decoded_fields: z.array(decodedFieldSchema).default([]),
+    /** Inferred schema hypotheses. */
+    schema_hypotheses: z.array(schemaHypothesisSchema).default([]),
+    /** Whether decoding was truncated. */
+    truncated: z.boolean().default(false),
+    /** Whether credentials were detected and redacted. */
+    credentials_redacted: z.boolean().default(false),
+});
+/** A captured protocol session with messages and inferred schemas. */
+export const protocolCaptureSchema = z.strictObject({
+    /** Protocol family for this capture. */
+    family: protocolFamilySchema,
+    /** Captured messages in order. */
+    messages: z.array(protocolMessageSchema).min(0).max(10_000),
+    /** Aggregated schema hypotheses across all messages. */
+    inferred_schema: z.array(schemaHypothesisSchema).default([]),
+    /** Whether any message was truncated. */
+    has_truncated: z.boolean().default(false),
+    /** Whether credentials were detected and redacted. */
+    credentials_detected: z.boolean().default(false),
+});
+/** Classification of a byte sequence as a known protocol family. */
+export function classifyProtocolFamily(contentType, path) {
+    if (contentType) {
+        if (contentType.includes("application/grpc"))
+            return "grpc";
+        if (contentType.includes("application/x-protobuf"))
+            return "protobuf";
+        if (contentType.includes("application/json-rpc"))
+            return "json-rpc";
+        if (contentType.includes("application/msgpack") ||
+            contentType.includes("application/x-msgpack"))
+            return "messagepack";
+    }
+    if (path) {
+        if (path.startsWith("/grpc.") || path.includes("/grpc/"))
+            return "grpc";
+        if (path.includes("/json-rpc") || path.includes("/jsonrpc"))
+            return "json-rpc";
+    }
+    return null;
+}
+/** Credential-like field names that should be redacted. */
+const CREDENTIAL_PATTERNS = [
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "api_key",
+    "apikey",
+    "authorization",
+    "auth",
+    "credential",
+    "private_key",
+];
+/** Check if a field path looks like it may contain credentials. */
+export function looksLikeCredential(path) {
+    const lower = path.toLowerCase();
+    return CREDENTIAL_PATTERNS.some((p) => lower.includes(p));
+}
+/** Decode a JSON-RPC message from raw payload bytes. */
+export function decodeJsonRpc(rawPayload) {
+    const text = new TextDecoder().decode(rawPayload);
+    const parsed = jsonValueSchema.parse(JSON.parse(text));
+    const fields = [];
+    if (typeof parsed === "object" && parsed !== null) {
+        for (const [key, value] of Object.entries(parsed)) {
+            if (looksLikeCredential(key)) {
+                fields.push({
+                    path: key,
+                    wire_type: "json",
+                    value: "[REDACTED]",
+                    inferred: false,
+                });
+            }
+            else {
+                fields.push({
+                    path: key,
+                    wire_type: "json",
+                    value,
+                    inferred: false,
+                });
+            }
+        }
+    }
+    return { decoded_fields: fields, truncated: false };
+}
+/** Decode a MessagePack message (simplified: only checks basic structure). */
+export function decodeMessagePack(rawPayload) {
+    const fields = [];
+    // MessagePack uses a single-byte type tag
+    if (rawPayload.length === 0) {
+        return { decoded_fields: [], truncated: false };
+    }
+    const tag = rawPayload[0];
+    if (tag === undefined)
+        return { decoded_fields: [], truncated: false };
+    // Map type: 0x80-0x8f (fixmap), 0xde (map16), 0xdf (map32)
+    if ((tag >= 0x80 && tag <= 0x8f) || tag === 0xde || tag === 0xdf) {
+        fields.push({
+            path: "type",
+            wire_type: "msgpack",
+            value: "map",
+            inferred: false,
+        });
+    }
+    // Array type: 0x90-0x9f (fixarray), 0xdc (array16), 0xdd (array32)
+    else if ((tag >= 0x90 && tag <= 0x9f) || tag === 0xdc || tag === 0xdd) {
+        fields.push({
+            path: "type",
+            wire_type: "msgpack",
+            value: "array",
+            inferred: false,
+        });
+    }
+    else {
+        fields.push({
+            path: "type",
+            wire_type: "msgpack",
+            value: "unknown",
+            inferred: true,
+        });
+    }
+    return {
+        decoded_fields: fields,
+        truncated: rawPayload.length > 10_000,
+    };
+}
+/** Decode a gRPC frame (5-byte header + protobuf payload). */
+export function decodeGrpcFrame(rawPayload) {
+    // gRPC uses a 5-byte prefix: 1 byte compressed flag + 4 byte length
+    if (rawPayload.length < 5) {
+        return {
+            decoded_fields: [
+                {
+                    path: "error",
+                    wire_type: "grpc",
+                    value: "frame too short",
+                    inferred: false,
+                },
+            ],
+            truncated: false,
+        };
+    }
+    const compressed = rawPayload[0] !== 0;
+    const length = ((rawPayload[1] ?? 0) << 24) |
+        ((rawPayload[2] ?? 0) << 16) |
+        ((rawPayload[3] ?? 0) << 8) |
+        (rawPayload[4] ?? 0);
+    return {
+        decoded_fields: [
+            {
+                path: "compressed",
+                wire_type: "grpc",
+                value: compressed,
+                inferred: false,
+            },
+            {
+                path: "message_length",
+                wire_type: "grpc",
+                value: length,
+                inferred: false,
+            },
+        ],
+        truncated: length > 10_000,
+    };
+}
+/** Infer schema hypotheses from a set of decoded messages. */
+export function inferMessageSchema(messages) {
+    const fieldCounts = new Map();
+    for (const msg of messages) {
+        for (const field of msg.decoded_fields) {
+            const existing = fieldCounts.get(field.path);
+            if (existing) {
+                existing.count++;
+                if (field.wire_type)
+                    existing.types.add(field.wire_type);
+            }
+            else {
+                fieldCounts.set(field.path, {
+                    count: 1,
+                    types: new Set(field.wire_type ?? "unknown"),
+                });
+            }
+        }
+    }
+    const hypotheses = [];
+    for (const [field_name, data] of fieldCounts) {
+        hypotheses.push({
+            field_name,
+            inferred_type: [...data.types].join("|"),
+            confidence: Math.min(1, data.count / messages.length || 0),
+            evidence_count: data.count,
+        });
+    }
+    return hypotheses;
+}

package/dist/domain/reconstructionReadinessSchemas.js

@@ -197,7 +197,21 @@ export const reconstructionReadinessInputSchema = z.strictObject({
     closure_history: z.array(closureObservationSchema).min(2).max(1_000),
     delegation_checks: z.array(delegationCheckSchema).min(1).max(1_000),
     replay: replaySchema,
-    stages: z.array(stageSchema).max(20),
+    stages: z
+        .array(stageSchema)
+        .length(9)
+        .superRefine((stages, context) => {
+        const seen = new Set();
+        stages.forEach((stage, index) => {
+            if (seen.has(stage.stage_id))
+                context.addIssue({
+                    code: "custom",
+                    path: [index, "stage_id"],
+                    message: "Readiness stage IDs must be unique",
+                });
+            seen.add(stage.stage_id);
+        });
+    }),
 });
 const findingSchema = z.strictObject({
     code: stableIdSchema,
@@ -233,7 +247,21 @@ export const reconstructionReadinessReportSchema = z.strictObject({
         cleanup_leak_count: z.number().int().min(0),
         nondeterministic_replay_count: z.number().int().min(0),
     }),
-    stages: z.array(stageSchema).max(20),
+    stages: z
+        .array(stageSchema)
+        .length(9)
+        .superRefine((stages, context) => {
+        const seen = new Set();
+        stages.forEach((stage, index) => {
+            if (seen.has(stage.stage_id))
+                context.addIssue({
+                    code: "custom",
+                    path: [index, "stage_id"],
+                    message: "Readiness stage IDs must be unique",
+                });
+            seen.add(stage.stage_id);
+        });
+    }),
     findings: z.array(findingSchema).max(10_000),
     evidence_links: z.array(evidenceIdSchema).max(100_000),
     snapshot: reconstructionReadinessInputSchema,

package/dist/domain/referenceSourceImportParsing.js

@@ -199,11 +199,11 @@ const parseWithBabel = (path, source, language) => {
         });
         return { ast, parseState: "parsed" };
     }
-    catch (error) {
+    catch (cause) {
         return {
             ast: undefined,
             parseState: "unknown",
-            reason: error instanceof Error ? error.message : "Parse failed",
+            reason: cause instanceof Error ? cause.message : "Parse failed",
         };
     }
 };

package/dist/domain/replayMachineRuntime.js

@@ -20,7 +20,7 @@ const replayEventHeadersSchema = z
         });
 });
 const replayEventFields = {
-    at_ms: z.number().int().nonnegative().safe(),
+    at_ms: z.number().int().safe().nonnegative(),
     path: z.string().startsWith("/").max(8_192),
     headers: replayEventHeadersSchema,
     body: z.string().max(1_000_000),
@@ -51,7 +51,8 @@ export const replayMachineEventSchema = z.discriminatedUnion("protocol", [
 ]);
 const parseJson = (value) => {
     try {
-        return JSON.parse(value);
+        const parsed = JSON.parse(value);
+        return parsed;
     }
     catch {
         return undefined;
@@ -70,7 +71,8 @@ const atPath = (value, path) => {
             current === null ||
             !Object.hasOwn(current, segment))
             return undefined;
-        current = current[segment];
+        const next = Reflect.get(current, segment);
+        current = next;
     }
     return current;
 };

package/dist/domain/sourceToBundleComparison.js

@@ -135,8 +135,8 @@ const comparisonCoverage = (projection, mappings, factors) => ({
 const scoringModel = () => ({
     algorithm: "rea-source-to-bundle-signals/v1",
     minimum_candidate_score: 20,
-    weights: Object.entries(SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS).map(([signal, weight]) => ({
-        signal: signal,
+    weights: SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS.map(([signal, weight]) => ({
+        signal,
         weight,
     })),
 });

package/dist/domain/sourceToBundleComparisonSchemas.js

@@ -6,14 +6,14 @@ const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
 const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
 const nodeIdSchema = z.string().regex(/^jag_node_[a-f0-9]{64}$/u);
 const boundedTextSchema = z.string().min(1).max(4_096);
-export const SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS = {
-    "exact-source-digest": 100,
-    "source-map-original-path": 70,
-    "current-path-exact": 60,
-    "current-path-suffix": 40,
-    "basename-match": 20,
-    "language-extension": 5,
-};
+export const SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS = [
+    ["exact-source-digest", 100],
+    ["source-map-original-path", 70],
+    ["current-path-exact", 60],
+    ["current-path-suffix", 40],
+    ["basename-match", 20],
+    ["language-extension", 5],
+];
 const sourceToBundleSignalKindSchema = z.enum([
     "exact-source-digest",
     "source-map-original-path",

package/dist/domain/sourceToBundleSignals.js

@@ -14,6 +14,12 @@ const PATH_PROPERTIES = [
     "declared_path",
 ];
 const MAX_PATH_SUFFIXES = 128;
+const signalWeight = (kind) => {
+    const entry = SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS.find(([signal]) => signal === kind);
+    if (entry === undefined)
+        throw new TypeError(`Missing source-to-bundle signal weight: ${kind}`);
+    return entry[1];
+};
 /** Keep source-bearing application nodes in stable identifier order. */
 export const sourceBearingNodes = (nodes) => nodes
     .filter(({ kind }) => RELEVANT_NODE_KINDS.has(kind))
@@ -145,7 +151,7 @@ const candidateSignals = (source, current) => {
 };
 const signal = (kind, sourceValue, currentValues) => ({
     kind,
-    weight: SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS[kind],
+    weight: signalWeight(kind),
     source_value: sourceValue,
     current_values: [...new Set(currentValues)].sort(compareText).slice(0, 64),
 });

package/dist/domain/staticRuntimeCorrelation.js

@@ -242,11 +242,12 @@ const selectStatic = (evidence, selector) => {
             throw new TypeError("Function selector requires function comparison Evidence");
         const result = functionComparisonResultSchema.parse(evidence.normalized_result);
         const matches = result.dimensions.filter(({ dimension }) => dimension === selector.dimension);
-        if (matches.length !== 1)
+        const match = matches.at(0);
+        if (matches.length !== 1 || match === undefined)
             throw new TypeError("Function selector must resolve exactly once");
         return {
-            status: matches[0].status,
-            conclusion_kind: matches[0].conclusion_kind,
+            status: match.status,
+            conclusion_kind: match.conclusion_kind,
         };
     }
     if (evidence.operation !== "compare_artifacts")
@@ -257,9 +258,10 @@ const selectStatic = (evidence, selector) => {
         result.changes.items.length !== result.changes.total)
         throw new TypeError("Static/runtime correlation requires complete artifact comparison pagination");
     const matches = result.changes.items.filter(({ logical_path: path }) => path === selector.logical_path);
-    if (matches.length !== 1)
+    const match = matches.at(0);
+    if (matches.length !== 1 || match === undefined)
         throw new TypeError("Artifact selector must resolve exactly one reported delta");
-    const status = matches[0].classification;
+    const status = match.classification;
     return {
         status,
         conclusion_kind: status === "contradiction"

package/dist/domain/webBundleAnalysis.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { inspectWebPageInputSchema } from "./browserObservation.js";
+import { inspectWebPageWithSourceInputSchema } from "./browserObservation.js";
 import { webTextArtifactSchema } from "./webContentArtifact.js";
 const webBundleLimitsSchema = z.object({
     max_findings: z.number().int().min(1).max(10_000).default(1_000),
@@ -21,12 +21,7 @@ const webBundleLimitsSchema = z.object({
     max_original_sources: z.number().int().min(1).max(20_000).default(2_000),
 });
 /** Capture-and-analyze input with separate source and source-map approvals. */
-export const analyzeWebBundleInputSchema = inspectWebPageInputSchema
-    .safeExtend({
-    include_script_sources: z.literal(true).default(true),
-    source_capture_approved: z.literal(true),
-    fetch_source_maps: z.boolean().default(false),
-    source_map_fetch_approved: z.boolean().default(false),
+const analyzeWebBundleFactsSchema = inspectWebPageWithSourceInputSchema.safeExtend({
     analysis_limits: webBundleLimitsSchema.default({
         max_findings: 1_000,
         max_ast_nodes: 250_000,
@@ -36,14 +31,19 @@ export const analyzeWebBundleInputSchema = inspectWebPageInputSchema
         max_source_map_mappings: 10_000,
         max_original_sources: 2_000,
     }),
-})
+});
+export const analyzeWebBundleInputSchema = z
+    .union([
+    analyzeWebBundleFactsSchema.safeExtend({
+        fetch_source_maps: z.literal(false).default(false),
+        source_map_fetch_approved: z.literal(false).default(false),
+    }),
+    analyzeWebBundleFactsSchema.safeExtend({
+        fetch_source_maps: z.literal(true),
+        source_map_fetch_approved: z.literal(true),
+    }),
+])
     .superRefine((input, context) => {
-    if (input.fetch_source_maps && !input.source_map_fetch_approved)
-        context.addIssue({
-            code: "custom",
-            path: ["source_map_fetch_approved"],
-            message: "Source-map network fetch requires separate approval",
-        });
     if (input.analysis_limits.max_source_map_bytes >
         input.analysis_limits.max_total_source_map_bytes)
         context.addIssue({

package/dist/domain/webCaptureDiff.js

@@ -228,20 +228,23 @@ const accessibilityComparable = (inspection) => {
     return { text, nodes, complete };
 };
 const accessibilityProjection = (accessibility, includeText, includeNodes) => {
-    const result = {
-        total_nodes: accessibility.total_nodes,
-    };
     if (!includeNodes)
-        return result;
+        return { total_nodes: accessibility.total_nodes };
     const nodeIndexes = new Map(accessibility.nodes.map((node, index) => [node.node_id, index]));
-    result.nodes = accessibility.nodes.map((node) => ({
-        parent_index: node.parent_id === null ? null : (nodeIndexes.get(node.parent_id) ?? -1),
-        role: node.role,
-        ignored: node.ignored,
-        states: node.states,
-        ...(includeText ? { name: node.name, description: node.description } : {}),
-    }));
-    return result;
+    return {
+        total_nodes: accessibility.total_nodes,
+        nodes: accessibility.nodes.map((node) => ({
+            parent_index: node.parent_id === null
+                ? null
+                : (nodeIndexes.get(node.parent_id) ?? -1),
+            role: node.role,
+            ignored: node.ignored,
+            states: node.states,
+            ...(includeText
+                ? { name: node.name, description: node.description }
+                : {}),
+        })),
+    };
 };
 const storageKeysComparable = (inspection) => sectionsComplete(inspection, ["storage_keys"]);
 const storageComparable = (before, after, keysComplete, usageComplete) => keysComplete &&

package/dist/dotnet/ManagedNativeBoundaryInspector.js

@@ -59,8 +59,7 @@ const emptyInspection = (target, bytes, classification, issues = []) => managedN
         "Static inspection does not load or execute target code, so native export resolution is not performed.",
     ],
 });
-const readBoundaryInventory = (bytes, pe, limits) => {
-    const cli = pe.cli;
+const readBoundaryInventory = (bytes, pe, cli, limits) => {
     const metadataOffset = pe.rvaToOffset(cli.metadata.rva, cli.metadata.size, "cli.metadata");
     const layout = readManagedMetadataLayout(bytes, metadataOffset, cli.metadata.size, limits.maxTableRows);
     const resourceDirectory = {
@@ -104,7 +103,7 @@ export const inspectManagedNativeBoundariesBytes = (bytes, target, limits) => {
     let layout;
     let inventory;
     try {
-        ({ layout, inventory } = readBoundaryInventory(bytes, pe, limits));
+        ({ layout, inventory } = readBoundaryInventory(bytes, pe, pe.cli, limits));
     }
     catch (cause) {
         if (!(cause instanceof ManagedReaderFailure))